CVE-2025-3125: WSO2 API Control Plane RCE Vulnerability

CVE-2025-3125 Overview

CVE-2025-3125 is an arbitrary file upload vulnerability affecting multiple WSO2 products. The flaw exists in the CarbonAppUploader admin service endpoint due to improper input validation [CWE-434]. An authenticated attacker with administrative privileges can upload a malicious file to a user-controlled location on the server. Successful exploitation can lead to remote code execution (RCE) within the WSO2 runtime context.

The vulnerability impacts core WSO2 platforms including API Manager, Identity Server, Enterprise Integrator, Universal Gateway, and Open Banking IAM. WSO2 published advisory WSO2-2025-3961 detailing the affected versions and patches.

Critical Impact

An authenticated administrator can write arbitrary files to attacker-chosen paths on the WSO2 server, enabling remote code execution and full compromise of the integration or identity platform.

Affected Products

• WSO2 API Manager 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0
• WSO2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0 and Identity Server as Key Manager 5.10.0
• WSO2 API Control Plane 4.5.0, Enterprise Integrator 6.6.0, Universal Gateway 4.5.0, Traffic Manager 4.5.0, Open Banking IAM 2.0.0

Discovery Timeline

• 2025-11-05 - CVE-2025-3125 published to NVD
• 2025-12-04 - Last updated in NVD database

Technical Details for CVE-2025-3125

Vulnerability Analysis

The CarbonAppUploader is an administrative SOAP service exposed by the WSO2 Carbon management framework. It accepts Carbon Application archives (.car files) for deployment to the server. The endpoint fails to properly validate or sanitize the file name and destination path supplied with the upload request.

An attacker authenticated as an administrator can craft a request to the upload service that specifies an arbitrary destination path. The server then writes the supplied file contents to that location, bypassing the expected deployment directory restrictions. Writing executable content into deployment directories such as repository/deployment/server/ or webapp paths allows the attacker to plant code that the runtime will execute.

This weakness maps to CWE-434 (Unrestricted Upload of File with Dangerous Type) and represents a Remote Code Execution vector through file upload abuse.

Root Cause

The root cause is insufficient input validation in the CarbonAppUploader admin service. The endpoint trusts client-supplied path and file name parameters without enforcing a canonical, sandboxed deployment directory. There is no allowlist of file extensions or destination paths.

Attack Vector

Exploitation requires network access to the WSO2 management service and valid credentials with administrative permissions. The attacker invokes the CarbonAppUploader service over HTTPS, supplies a malicious payload, and specifies a writable target path on the server. Once the file is written to a directory monitored by the WSO2 deployment engine or web container, the payload executes in the server process context.

No verified public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.213% as of the latest scoring date.

For exploitation specifics, refer to the WSO2 Security Advisory WSO2-2025-3961.

Detection Methods for CVE-2025-3125

Indicators of Compromise

• Unexpected files appearing under repository/deployment/server/carbonapps/ or other WSO2 deployment directories outside of normal change windows.
• SOAP requests to the CarbonAppUploader admin service originating from non-administrative subnets or from unusual user agents.
• New JSP, class, or script files written into webapps/, tmp/, or other writable directories shortly after authenticated admin sessions.
• Child processes spawned by the WSO2 Java process executing shell commands, curl, wget, or scripting interpreters.

Detection Strategies

• Audit WSO2 Carbon admin service access logs for calls to CarbonAppUploader and correlate with the authenticated principal and source IP.
• Monitor file integrity on WSO2 deployment directories and flag writes that do not originate from approved deployment pipelines.
• Alert on Java runtime processes spawning interactive shells or outbound network connections to untrusted destinations.

Monitoring Recommendations

• Forward Carbon audit logs, HTTP access logs, and host process telemetry to a centralized analytics platform such as Singularity Data Lake for correlation across the WSO2 fleet.
• Use behavioral AI identification in Singularity Endpoint to flag post-exploitation activity such as web shell execution or credential harvesting from the WSO2 server.
• Track administrative account usage and enable alerts on privilege changes and new admin role assignments inside WSO2.

How to Mitigate CVE-2025-3125

Immediate Actions Required

• Apply the WUM updates or version upgrades published in WSO2 advisory WSO2-2025-3961 to all affected products.
• Rotate administrative credentials and review all accounts holding admin-level roles, removing any unnecessary privileges.
• Restrict network exposure of the WSO2 management console and admin services to trusted management networks only.
• Review deployment directories for unauthorized .car, .jsp, or executable artifacts and remove any suspicious files.

Patch Information

WSO2 has released fixes for the affected products. Customers with active subscriptions should apply the relevant WSO2 Update Manager (WUM) updates referenced in the WSO2 Security Advisory WSO2-2025-3961. Open-source users must upgrade to the patched product versions listed in the advisory.

Workarounds

• Disable or block external access to the CarbonAppUploader admin service if it is not required for operations.
• Enforce IP allowlisting at a reverse proxy or web application firewall in front of the WSO2 management endpoints.
• Apply the principle of least privilege so that only a minimal number of accounts hold the administrative role required to invoke the upload service.
• Enable multi-factor authentication for all WSO2 administrative accounts where supported.

# Example: restrict the Carbon admin services path at an upstream reverse proxy
location ~* /services/CarbonAppUploader {
    allow 10.10.0.0/24;   # management network
    deny all;
    proxy_pass https://wso2-backend;
}